Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 06:02
Static task
static1
Behavioral task
behavioral1
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
-
Size
422KB
-
MD5
f55920966b4970588ce643af0fcc03a7
-
SHA1
97c44c58f24358442cb1811a7694e5b395e82d61
-
SHA256
0d533321292f6854d7f9705a738d58ee5941c93b52674681083ec5c21a987ab1
-
SHA512
b5e6f91e65eacd6c1ad5f563f0d9184fd21fb88848008c7ea568d7c40c63fcbf217eeee2830a521313a3152e538821a469630fe951e760405972afae8516023e
-
SSDEEP
12288:yClc4hq+Ytl63+YzGKBTpJHtvgqYe7S9S:Tlc4kBl6OabpFtGgS0
Malware Config
Extracted
zloader
-
build_id
49
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dyac = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Caycu\\ebcofuf.dll,DllRegisterServer" msiexec.exe -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 4 3052 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2156 set thread context of 3052 2156 rundll32.exe msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exemsiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 3052 msiexec.exe Token: SeSecurityPrivilege 3052 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2448 wrote to memory of 2156 2448 rundll32.exe rundll32.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe PID 2156 wrote to memory of 3052 2156 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3052